> ## Documentation Index
> Fetch the complete documentation index at: https://www.thundercompute.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH on Thunder Compute

> Establish SSH connections using the CLI. Configure public key authentication and manage secure remote sessions from the terminal.

<Columns cols={3}>
  <Card title="VS Code" icon="window" href="/vscode/operations/ssh" color="#95c5ea" className="platform-card">
    Editor extension
  </Card>

  <Card title="CLI" icon="terminal" color="#95c5ea" className="platform-card platform-current">
    Command line
  </Card>

  <Card title="Console" icon="browser" href="/console/operations/ssh" color="#95c5ea" className="platform-card">
    Web interface
  </Card>
</Columns>

<Warning>
  Manually SSHing is an advanced escape hatch. Thunder Compute already handles SSH, port forwarding, and key rotation through the **CLI**, **VS Code extension**, and **console**. Stick to the standard connect flows unless you have existing infrastructure that relies on raw SSH.
</Warning>

## Save an SSH key

Run `tnr ssh-keys add` to launch the interactive picker. The CLI autodetects keys in `~/.ssh/*.pub`, so you just confirm the one you want.

```bash theme={null}
tnr ssh-keys add
```

Use `tnr ssh-keys list` anytime to verify what is saved:

```bash theme={null}
tnr ssh-keys list
```

Saved keys live at the org level, so everyone on your team can reuse them when creating instances.

## Attach a key when creating an instance

Pass `--ssh-key <name>` to `tnr create`:

```bash theme={null}
tnr create --ssh-key my-key
```

The CLI links your local private key for your reference, but `tnr connect` does not reuse these keys—it maintains its own managed access.

Instances include the selected public key in `authorized_keys` at boot. You can add keys later via the [Add SSH key to instance](/api-reference/instances/add-ssh-key-to-instance) API endpoint.

## SSH manually

1. Find the instance IP and SSH port from the table output of `tnr status`:

   ```bash theme={null}
   tnr status
   ```

   The SSH port is shown alongside the IP as `IP:Port` (e.g., `203.0.113.5:12345`). The port is **not always 22** and varies per instance, so confirm it each time you reconnect.

2. From your local machine, run SSH with the private key that matches the saved public key, the reported port, and the `ubuntu` user:

   ```bash theme={null}
   ssh -i ~/.ssh/id_ed25519 -p <port> ubuntu@<instance-ip>
   ```

   Replace `~/.ssh/id_ed25519` with your private key path. Substitute `<port>` with the value from `tnr status`. Most images use the `ubuntu` user; check your template if it differs.

3. Optional: copy the command into JetBrains Gateway or any remote-SSH client.

## Quick troubleshooting

* **Permission denied:** make sure you are connecting as `ubuntu`, using the `-p <port>` from instance details, and that the matching private key exists locally (the CLI will warn if it cannot link it).
* **Connection timed out:** re-check that you copied the correct port; the IP stays stable, but the exposed port can change if the instance is cycled.
* **Host verification failed:** remove the old entry from `~/.ssh/known_hosts` and retry. New IPs will change fingerprints.
* **Still stuck?** Double-check the IP, port, and key, or send a message in [Discord](https://discord.com/invite/thundercompute) with the SSH output.